For services with system-to-system access, which change management requirement MOST effectively reduces the risk of business disruption to the…

For system-to-system access (e.g., APIs), where systems are tightly integrated, an uncoordinated change can cause immediate failure. The most effective control to prevent business disruption is a contractual requirement for the service provider to give advance notice of changes and provide a test environment. This allows the outsourcer to proactively test the change's impact on its own systems before production deployment. This preventative approach identifies and resolves integration issues beforehand, directly reducing the risk of business disruption.

A. Requiring all changes to be approved by the outsourcer's CEO is impractical, inefficient, and creates bottlenecks for routine operational changes.

C. Ensuring the service provider has a comprehensive rollback plan is a reactive control; it helps recover from a failure but does not prevent the initial disruption.

D. Limiting the frequency of changes to once per year is overly restrictive, stifles innovation, and does not guarantee that the single annual change will be non-disruptive.

1. Shared Assessments, Certified Third Party Risk Professional (CTPRP) Body of Knowledge, Domain 4: Ongoing Monitoring & Review. This domain emphasizes the need for continuous oversight, including managing changes made by third parties that could impact the outsourcer's operations.

2. ITIL Foundation, ITIL 4 Edition. AXELOS, 2019. The "Change Enablement" practice (formerly Change Management) emphasizes assessing risks, scheduling, and testing changes to prevent negative impacts on services, aligning with the principle of providing notice and a test environment.